Well, interestingly if it's not nmap (limited port scanning since it only appears to do 135, 139, 445, 1433) then it might be ExecuBot.B or some other bot variant?